devilcv8

I have a small OmniPcx that is having a couple of it's extensions forwarded to an international number.
The number is displayed on the handset, and the call forwards are even being set when the handsets are unplugged which is leading to a conclusion of remote access. Vendor has assured me that no one has remotely accessed the system to set the call forwards.
A number of things have been tried.
Personal assistant disabled
call barring after hours
maintenance password changed

the only thing that has saved us is carrier has blocked international, yet the "hacker" has continually set the call forwards every night.

I don't have any programming knowledge or even access to the system.

Any thoughts. questions etc.